Clearinghouses are suddenly everywhere. Over the past few weeks, it seems like every security company announced one. Chainguard did too — theirs is called Athena, and the difference is that it was already running when they announced it. Built quietly over months, shipping fixes, because customers kept asking them to.
Chainguard only went public because everyone else started announcing theirs, and staying quiet started looking suspicious.
Here’s the part those other announcements won’t tell you: the clearinghouse is the least important thing to build.
Clearinghouses aren’t new. The NVD is one. So is the GitHub Advisory Database, OSV.dev, and every vendor’s vulnerability portal. They all do the same thing: pool vulnerability data and put a front door on it.
What’s different this summer is the data going into these pools — pre-disclosure vulnerabilities across the long tail of open source. Some in critical projects, some in tiny libraries nobody’s heard of. And because of how Unix processes work, they all matter the same. A flaw in the most obscure dependency runs with the same privileges as the app that loaded it.
But data is inert. A finding in a database has never patched anything by itself. The real value is actuation — turning that finding into a rebuilt, tested, signed artifact that’s backported to the version you’re actually running. Not “here’s an advisory, good luck.” A fix, where you’ll consume it, before you go looking for it.
Chainguard’s build system has been doing this for years. It watches thousands of open source projects and reacts the moment an advisory lands. Most CVEs get remediated in roughly two days. They hold a one-day SLA on vulnerabilities CISA says are actively exploited. Over 100,000 remediations so far.
The clearinghouse was always the input. The factory was the product. That’s what actually matters — not another database, but the machinery that turns alerts into patches before your developers even know there was a problem.
